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ABSTRACT 

The U.S. and international aviation communities have adopted the Required Navigation 
Performance (RNP) process for defining aircraft performance when operating in the en-route, 
approach and landing phases of flight. RNP consists primarily of the following key parameters - 
accuracy, integrity, continuity and availability. The processes and analytical techniques employed 
to define en-route, approach and landing RNP have been applied in the development of RNP for 
the airport surface 

The development of airport surface RNP began with the classification of the various phases of 
aircraft operations on airport surface areas. All aspects of an aircraft’s movement on the airport 
surface were examined - exiting the runway, normal taxi, and apron taxi. Additional variables 
defined within these operational phases are aircraft taxi speeds, exposure times to the various 
phases of taxiing, and visibility conditions on the airport surface. A surface movement Target 
Level of Safety (TLS) was established, followed by an allocation of risks to each phase of surface 
movement. Other factors considered in the determination of the airport surface RNP include the 
reaction of the pilot to various navigation system failures and containment limits imposed on the 
aircraft when operating within the confines of the airport environment. The result is a set of 
proposed requirements for accuracy, integrity, continuity, and availability for each phase of 
surface movement. 

To validate the proposed RNP requirements several methods were used. Operational and flight 
demonstration data were analyzed for conformance with proposed requirements, as were several 
aircraft flight simulation studies The pilot failure risk component was analyzed through several 
hypothetical scenarios. Additional simulator studies are recommended to better quantify crew 
reactions to failures as well as additional simulator and field testing to validate achieved accuracy 
performance. 

This research was performed in support of the NASA Low Visibility Landing and Surface 
Operations Program. 
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1.0 INTRODUCTION 

One of the anticipated applications of Global Navigation Satellite Systems (GNSS), including the 
Global Positioning System (GPS), is aircraft navigation on the airport surface. With the 
implementation of local area differential GNSS, technology will be available to enable aircraft to 
obtain accurate position information when taxiing on the airport. Currently, navigation 
performance standards do not exist for aircraft operations on the airport surface. Standards are 
under development by the International Civil Aviation Organization (ICAO) All Weather 
Operations Panel (AWOP) for Advanced Surface Movement Guidance and Control Systems (A- 
SMGCS) and by the RTCA Airport Surface Navigation and Surveillance subgroup of Special 
Committee 159. Under contract to NASA Langley Research Center as part of the Terminal Area 
Productivity Program, Rannoch is developing the Required Navigation Performance (RNP) 
requirements for surface movement navigation. 

This report presents a summary of RNP development, including definition of the operation Target 
Level of Safety (TLS) and proposed requirements for the four RNP parameters-integrity, 
continuity, accuracy and availability. In addition to definition of system level requirements, the 
report presents proposed allocations for navigation sensor performance, which defines the 
performance needed by a GNSS-based system to satisfy system RNP requirements. 

RNP is a relatively new concept that is being applied to develop navigation standards for all 
phases of aircraft operations, including en route, landing and surface operations. See references 1 
and 2 for a description of RNP for approach and landing and references 3 and 4 as it pertains to 
the en route phase of flight. RNP is a probabilistic approach to evaluating an aircraft’s deviation 
from its intended course. One of the benefits of the RNP approach is that it allows the design 
engineer to trade off elements of error budgets between subsystems. For example, a newer 
autopilot design may allow the use of a less accurate sensor or ground system. The RNP 
approach also goes beyond the accuracy of a system and provides quantitative requirements for a 
system’s continuity and integrity. In this report the RNP process is applied to aircraft surface 
movements. The main components of RNP as developed for this application are: 

• RNP Parameter Definition 

• Operation Classification 

• Target Level of Safety Risk Allocation 

• Accident/Incident Ratio 

• Risk Allocations 

• Pilot Risk Factor 

• Integrity and Continuity 

• Containment Limit 

• Accuracy 

• Availability 

• Validation 

Each of these are discussed in the following sections. 
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2.0 REQUIREMENTS DEVELOPMENT 


2. 1 RNP Parameter Definitions 

2.1.1 Required Navigation Performance (RNP) 

RNP is a statement of the navigation performance accuracy necessary for operation within a 
defined airspace [3], There are four primary parameters used to define RNP - accuracy, integrity, 
continuity and availability. The definitions given below are based on those used for other phases 
of flight [1,3]. However, they have been tailored for application to airport surface movement. As 
applied here the terms navigation and guidance have the same meaning. 

2.1.2 Accuracy 

Accuracy is defined in terms of the Total System Error (TSE) as the difference between the true 
position and the desired position. The accuracy requirement is for the TSE to remain within a 
normal performance region, under fault-free conditions, 95% of the time [5], 

2.1.3 Integrity 

Integrity relates to the trust which can be placed in the correctness of the navigation information 
supplied by the navigation system. Integrity includes the ability of the navigation system to 
provide timely and valid alerts to the user when the system must not be used for the intended 
operation. Integrity risk is the probability of an undetected failure that results in the TSE 
exceeding the Containment Limit (CL) [5], 

2.1.4 Continuity 

Navigation continuity is the capability of the navigation system (comprising all elements necessary 
to maintain aircraft position within the containment region) to perform the navigation function 
without unscheduled interruption during the intended operation. Continuity risk is the probability 
that the system will be interrupted and not provide navigation information over the period of the 
intended operation. More specifically, continuity is the probability that the system will be 
available for the duration of an operation, presuming that the system was available at the 
beginning of the operation [5], 

2.1.5 Availability 

Availability is an indication of the ability of the navigation function to provide usable service 
within the specified coverage area, and is defined as the portion of time during which the system is 
to be used for navigation, during which reliable navigation information is presented to the crew, 
autopilot, or other system managing the movement of the aircraft. Availability is specified in 
terms of the probability of the navigation function being available at the beginning of the intended 
operation [5], 


2.2 Operation Classification 

The surface operation is considered in phases, including rollout, high speed taxi exit, and normal 
taxi. The definition of phases is related to aircraft taxi speed and each phase of the operation is 
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considered for different visibility conditions Figure 1 shows a summary of the phases of 
operation selected for surface movement. 



Figure 1. Phases of Surface Operation 

Rollout is defined as touchdown to the point where the aircraft decelerates below 60 lets [1], 
Operationally, rollout is considered to be a part of the aircraft landing, therefore the RNP for that 
phase of surface movement is defined by the Category III landing RNP. After completing rollout 
the aircraft will enter into the taxi phase, which is defined as either high speed, normal or apron 
taxi. For runways with a rapid exit taxiway (also referred to as a high speed exit), the aircraft will 
end rollout by taxiing at a high speed. After the aircraft has decelerated it enters the normal taxi 
phase. The aircraft then enters the apron area and initially will travel on an apron taxiway. When 
the aircraft enters the stand area it will be moving on a stand taxilane at its slowest taxi speed. In 
some operations there is also a docking maneuver. 

For the departing aircraft, the order of the phases of operation is from the stand to normal/apron 
taxi to takeoff roll. The takeoff roll is covered in the RNP for aircraft departure and is therefore 
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not included as part of the surface movement RNP. High speed taxi is normally at speeds 
between 30 and 70 kts, which occur with the use of rapid exits. This is based on measurements of 
operational speeds [6, Appendix A] and the need to limit lateral acceleration [7] The study in 
reference 7 defined a requirement to limit the lateral acceleration to 0. 15 g, which results in a 
maximum exit velocity of 70 kts. It should also be noted that the ICAO aerodrome design manual 
assumes a velocity of 50 kts for rapid exit taxiways [8], However, operational data [6] shows 
instances of higher velocities, which should be accommodated in the analysis. Normal/apron 
taxiway speeds range from 10-50 kts. The 50 kts maximum for normal taxi is based upon a 
U K study that found maximum speeds on straight sections as high as 49 kts, with the average 
being slightly under 20 kts [6], Speeds are reduced during turns, therefore the range is reduced to 
a maximum of 20 kts. When the aircraft enters the stand taxilane phase of surface movement it 
will have a ground speed between 0 and 10 kts. To determine the risk for each phase of 
operation, an associated exposure time must be assigned. Exposure times were determined by 
evaluating typical taxi distances for each phase for nine major U.S. airports [9, Appendix B], 

Table 1 summarizes the velocities and exposure times for the different phases. 


Table 1. Taxi Speeds and Exposure Times 


Taxi Phase 

Taxi 

Speed 

(knots) 

Exposure 

Time 

(minutes) 

Rapid Exit 
(High Speed) 

30-70 

0.5 

Normal/Apron 
Taxiway - straight 

10-50 

6 

Normal/ Apron 
Taxiway - 90° turn 

10-20 

Stand/ 

Stand Taxilane 

0-10 

3 


As stated earlier, each phase of the surface operation must be considered for different visibility 
conditions. Currently, visibility conditions have four classifications according to ICAO [5] and 
are defined below. Conditions 3 and 4 are essentially equivalent to approach and landing 
Category III 

Visibility Condition 1 : Visibility sufficient for the pilot to taxi and to avoid collision with other 
traffic on taxiways and at intersections by visual reference, and for personnel of control units to 
exercise control over all traffic on the basis of visual surveillance (RVR > 400 m/1300 ft). 
Visibility Condition 2: Visibility sufficient for the pilot to taxi and to avoid collision with other 
traffic on taxiways and at intersections by visual reference, but insufficient for personnel of control 
units to exercise control over all traffic on the basis of visual surveillance (RVR > 400 m/1300 ft). 
Visibility Condition 3 : Visibility sufficient for the pilot to taxi but insufficient for the pilot to 
avoid collision with other traffic on taxiways and at intersection by visual reference with other 
traffic, and insufficient for personnel of control units to exercise control over all traffic on the 
basis of visual surveillance (75 m/250 ft < RVR < 400 m/1300 ft). 

Visibility Condition 4 : Visibility insufficient for the pilot to taxi by visual guidance only (RVR < 

75 m/250 ft). 
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For the purposes of this report, Visibility Conditions 1 and 2 were treated as a single category 
(referred to as Visibility Condition 1,2) because these conditions are identical from the crew's 
perspective 

2.3 TLS Risk Allocation 

The target level of safety established by ICAO for the entire operation or mission is one accident 
per 10 7 operations [5], It is necessary to allocate a portion of this to the taxi phase. One method 
of determining an appropriate TLS for an operation is to base it upon the historical accident rate. 
Two sources of accident data are used here-worldwide data, and National Transportation Safety 
Board (NTSB) data for aircraft operations in the U S. Worldwide accident data reveals the 
following: 

• Overall fatal accident rate ( 1 985-94) = 1 . 8 x 1 O ' 6 per operation [ 1 0, 1 1 ] 

• Taxi accidents (including load and unload) account for 5% of fatal accidents [12] 

• Therefore, the fatal taxi accident rate = 9.0 x 10' 8 per operation. 

NTSB accident data for the U S. is summarized as follows: 

• Overall fatal accident rate (1985-94) = 0.56 x 10" 6 per operation [13] 

• Fatal taxi accidents account for 1 1% of all fatal accidents [13] 

• Therefore, the fatal taxi accident rate = 6.2 x 10’ 8 per operation. 

The ICAO and NTSB fatal taxi accident rates are similar (9.0 vs. 6.2 x 10’ 8 per operation). The 
final approach and landing phase was allocated 1 .0 x 10' 8 [1,2]. Similarly, the other phases of 
flight have allocations that use only a small portion of the overall TLS. Therefore, the taxi phase 
should be allocated a comparable portion. Based on the above, the surface movement TLS was 
established at 1.0 x 10' 8 fatal taxi accidents per operation. This provides a margin of 6-9 over the 
historical accident rate and is in line with the allocations used for the approach and landing RNP. 

It should be noted that this TLS applies to all visibility conditions of surface operations. Figure 2 
shows the allocation of risk from the TLS to integrity and continuity requirements for the 
guidance function. The TLS is initially divided between the four functions associated with surface 
movement (surveillance, guidance, control and routing). Risks were divided equally except for 
routing, which was assigned a lower risk because it is a less complex function. Following is an 
explanation of the allocation process for the guidance (or navigation) risk. 

2.4 Accident/Incident Ratio 

Since not all incidents translate to accidents, there is a ratio assigned. An incident is defined as 
any time the aircraft leaves the containment region (to be defined later). There are actually two 
ratios used - fatal accident/accident and accident/incident. These ratios were based primarily on 
NTSB data for accidents on the airport surface. 
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TLS Risk 
l.Ox KH 


I Surveillance Risk i 

1 

j Guidance Risk 1 

1 Control Risk 

Routing Risk 

! 3.0 x 10-’ 

I i 

3.0x10-’ 

* 1 ' 

| 3.0x10-’ 

| 1.0x10-’ 


Fatal Accident 
Accident Ratio 
1/10 


Accident' 
incident Ratio 
1/5 



Incident Risk 
1.5 x 10 ' 7 


Departure Risk 

7.5 x 10 8 


Stand/ 

Stand Taxilane 

1.5 x 10 


Normal/ Apron 
Taxi 

6.0 xlO 41 


Undetected Failures 


Integrity Risk 


Pilot Failure Risk 


Loss of Integrity 


Normal/ Apron 
Taxi 
6.0 x 10 


Arrival Risk 
9.0 x 10 -8 


High Speed Taxi 
1.5x10-* 


Failure Mode 
and Visibility 
Condition 
Dependent 


Detected Failures 


Continuity Risk 


Pilot Failure Risk 


Loss of Continuity 


Stand;' 

Stand Taxilane 

1.5 x 10- 8 


Containment 
Incident Risk 


Figure 2. RNP Risk Allocation 

2.5 Risk Allocations 

The overall TLS is allocated to each phase of the surface operation. The TLS includes all phases 
of an operation, so for the surface, both departure and arrival must be included. Risk levels are 
assigned to each phase-high speed taxi, normal taxi, etc. Failures are identified as continuity or 
integrity. The reason for different allocations is different exposure times. The values shown in 
Figure 2 are on a per operation basis. The requirements have been allocated such that when 
normalized to a per hour basis they are roughly equal over all phases of the operation and are 
shown in Table 2. 


Table 2. Allocation of Integrity and Continuity Risk 

Visibility Phase Failure RNP Pilot Failure RNP Exposure 
Condition Mode Risk Risk Allocation Time 


Risk 

(per hour) 
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(Minutes) 


1,2 

Stand Taxilane 

Continuity 

7.50E-09 

5.0E-06 

1.5E-03 

3.0 

3.00E-02 


Stand Taxilane 

Integrity' 

7.50E-09 

5.0E-05 

I.5E-04 

3.0 

3.00E-03 


Normal/ Apron 

Continuity 

3.00E-08 

1.0E-04 

3.0E-04 

6.0 

♦3.00E-03 


Normal/ Apron 

Integrity' 

3.00E-08 

1.0E-04 

3.0E-04 

6.0 

3.00E-03 


High Speed 

Continuity' 

5.00E-09 

1.0E-04 

5.0E-05 

0.5 

6.00E-03 


High Speed 

Integrity 

5.00E-09 

3.0E-03 

1.7E-06 

0.5 

♦2.00E-04 

3 

Stand Taxilane 

Continuity' 

7.50E-09 

5.0E-05 

1.5E-04 

3.0 

3.00E-03 


Stand Taxilane 

Integrity 

7.50E-09 

5.0E-03 

1.5E-06 

3.0 

3.00E-05 


Normal/ Apron 

Continuity 

3.00E-08 

1.0E-04 

1.5E-04 

6.0 

♦3.00E-03 


Normal/Apron 

Integrity 

3.00E-08 

1.0E-02 

3.0E-06 

6.0 

♦3.00E-05 


High Speed 

Continuity 

5.00E-09 

1.0E-04 

1.3E-05 

0.5 

6.00E-03 


High Speed 

Integrity 

5.00E-09 

1.5E-02 

3.3E-07 

0.5 

4.00E-05 

4 

Stand Taxilane 

Continuity 

7.50E-09 

1.0E-04 

1.5E-05 

3.0 

♦1.50E-03 


Stand Taxilane 

Integrity 

7.50E-09 

5.0E-02 

1.5E-07 

3.0 

3.00E-06 


Normal/ Apron 

Continuity 

3.00E-08 

1.0E-04 

3.0E-05 

6.0 

3.00E-03 


Normal/ Apron 

Integrity 

3.00E-08 

1.0E-01 

3.0E-07 

6.0 

♦3.00E-06 


High Speed 

Continuity 

5.00E-09 

1.0E-04 

2.5E-06 

0.5 

6.00E-03 


High Speed 

Integrity' 

5.0E-09 

1.0E-01 

5.0E-08 

0.5 

6.00E-06 


* Most stringent requirements for that visibility condition. 


2.6 Pilot Risk Factor 

Figure 3 shows the pilot failure risk factors assigned for various failure modes and visibility 
conditions at stand taxilane, normal/apron and high speed taxi aircraft movements. The risk 
factor is dependent on several variables, all of which affect the probability of an incident The 
mode of failure determines whether the crew receives a warning that a failure has occurred. If a 
continuity failure occurs, the crew will receive a warning immediately following the failure. An 
integrity failure will yield no warning, therefore the crew will depend on visual cues to recognize 
that a failure has occurred Consequently, longer response times can be expected for integrity 
failures Since the crew relies on visual, out-the-window views, visibility will primarily drive pilot 
risk for the integrity failure mode. For example, low visibility can be expected to generate longer 
pilot response times and higher risk. Aircraft velocity affects the amount of time the crew has to 
respond to a failure. The greater the aircraft velocity, the longer the braking distance, and 
consequently the less time the crew has to respond to the failure. Crew response time will also be 
longer because of an increased crew workload when traveling at high speeds on the airport 
surface (i.e., high speed exit taxiing). See 3.4 1 for a complete discussion of the validation of the 
pilot risk factor values. 
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Figure 3. Pilot Risk Allocations 


2.7 Integrity and Continuity Requirements 

The RNP risk allocation is equally divided between integrity and continuity (Figure 2). Table 2 
lists the allocations for all cases. Table 3 summarizes the most stringent integrity and continuity 
requirements for different visibility conditions. Each phase of surface operation is theoretically 
allocated a different risk, but in order to simplify the standards only the most stringent values are 
recommended as the requirement. 


Table 3. Integrity and Continuity Risk (per hour) 



Visibility Condition ! 

u 

3 

4 

Integrity 

2.0 x 10^ 

3.0 x 10 s 

3.0 x KT 6 

Continuity 

3.0 x 10' 3 

3.0 x 10‘ 3 

1.5 x 10 ‘ 3 


2.8 Containment Limit 

Figures 4 and 5 illustrate key taxiway design standards [8,14, 15]. The two parameters of 
concern are the relationship of the main wheels to the edge of the taxiway and its shoulder, and 
the margin between the wing tips and the closest allowable objects. Figure 4 shows straight 
sections of taxiways and Figure 5 curved sections. 
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Figure 4. Taxiway Design Standards (straight segments) 

The difference with curved sections is that normally there is additional pavement added to the 
inside of the curve in the form of a fillet. This compensates for the fuselage of the aircraft 
deviating to the inside when making a turn, assuming that the pilot steers by maintaining the 
cockpit (and nosewheel) over the centerline of the taxi way. The amount of extra fillet required is 
sufficient to maintain the same margins between the wheels and taxiway edge. At airports where 
there is no fillet the pilot is required to use “judgmental oversteering” to maneuver the aircraft, 
where the nosewheel is purposely steered outside the centerline, thus keeping the fuselage from 
deviating to the inside of the curve. 



Figure 5. Taxiway Design Standards (curved segments) 

The Containment Limit definition assumes operation at an aerodrome that meets taxiway widths 
and the minimum separation distances specified in ICAO Annex 14 [14], Table 4 indicates the 
taxiway widths categorized according to aerodrome code. Codes D and E are designed to handle 
widebody commercial aircraft (B-747, DC- 10), code C corresponds to midsize aircraft (B-737, 
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DC-9), and codes A and B relate to general aviation aircraft. For code E, there is a 15 5 m 
margin between the wing tips and any objects, including wings of aircraft on parallel taxiways. 

The minimum margin between the main wheels and taxiway edge is 4.5 m. The standards also 
recommend a 10.5 m shoulder, thus yielding a 15 m margin between the wheels and outer edge of 
the shoulder. The result is that the aircraft can deviate by 15 m from the taxiway centerline before 
there is risk of an incident, and therefore the CL is defined to be this value. For the purposes of 
this report, it is assumed that all deviations are referenced to the nosewheel of the aircraft. 


Aerodrome 
reference 
code letter 

Taxiway 

width 

(meters) 

Maximum 
outer main 
gear wheel 
span 
(meters) 

Margin 
between 
main gear 
and taxiway 
edge 
(meters) 

Distance 
between 
centerline 
and object 
(meters) 

Maximum 
wing span 
(meters) 

Wing tip to 
object 
margin - 
taxiways 
(meters) 

Wing tip 
to object 
margin - 
stand 
taxilane 
(meters) 

Wing tip 
to object 
margin - 
stand 
(meters) 

A 

7.5 

4.3 

1.5 

16.25 

15 

8.75 


3.0 

B 

10.5 

6.0 

2.25 

21.5 

24 

9.5 

4.5 

3.0 

C 

18 

9.0 

4.5 

26.0 

36 

8.0 

6.5 

4.5 

C 

15 

6.0 

3.0 

26.0 

36 

8.0 

6.5 

4.5 

D 

23 

14.0 

4.5 

40.5 

52 

14.5 

10.0 

7.5 

D 

18 

9.0 

4.5 

40.5 

52 

14.5 

10.0 

7.5 

E 

\T_i 

23 

14.0 

4.5 

47.5 

65 

15.0 

10.0 

7.5 


, Taxiways, Aprons and Holding Bays [8 


Table 5 lists the CL values based on minimum separation distances for aircraft for all taxiway 
design codes. The CL of 1 5 m is applicable only to codes D and E. Since the margin is less for 
codes A, B and C, the CL for those cases is defined accordingly as 8 m. In the stand taxilanes, 
the boundary is dependent on the minimum clearance between the aircraft’s wing tips and other 
objects. In the stand area, the relationship of the main wheels to the edge of the taxilane is not of 
concern because there is a continuous pavement area; therefore, only the wing tip margins 
determine the CL. As would be expected, the safety margins and associated CLs decrease in the 
stand areas since it is assumed the aircraft is moving slower and is able to track the centerline 
more accurately. The probability of an aircraft deviating outside the boundary of the containment 
region is equal to the incident risk for the appropriate surface operation. These are indicated in 
Figure 2, and are either 1.5x10 * (high speed taxi and stand/stand taxilane) or 6.0 x 10 * (normal 
and apron taxi). 


Aerodrome 

Code 

Taxiways 
Containment 
Limit (meters) 

Stand Taxilanes 
Containment Limit 
(meters) 

Stand 

Containment Limit 
(meters) 

A 

8 

4.5 

3.0 

B 

8 

4.5 

3.0 

C 

8 

6.5 

4.5 

D 

15 

10 

7.5 

E 

J i- 

15 

10 

7.5 


Note: Aerodrome reference code is according to the code letter definition in Annex 14, paragraph 1.3 [14] 
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2.9 Accuracy 

2.9.1 Derivation of Total System Error 

The accuracy requirement establishes normal performance or 95% TSE, defined as the difference 
between actual aircraft position and the desired path (see Figure 6). 



The constraining limit used in establishing the accuracy requirement is the margin between the 
aircraft wheels and taxi way edge (4.5 m for codes D and E). The normal performance limit 
should be established to minimize the probability of the wheels leaving the taxiway. The 
probability allocated is the equivalent of 4a or 6.3 x 10' 5 , based on the assumption that the TSE 
distribution is gaussian. Defining the deviation to the taxiway edge as a 4a value and the normal 
performance as 2 a (approximately 95%), the accuracy requirement is obtained by dividing the 
wheel margin by two. For aircraft with 4.5 m wheel margins the resulting accuracy requirement is 
± 2.2 m. The resulting TSE requirements for all cases are given in Table 6. 


Tab 

le 6. Normal Performance Requirements 

Aerodrome 

Code 

Taxi way 
Width 
(meters) 

95% total system error (meters) | 

Taxiways 

Stand 

taxilanes 


A 

7.5 

0.7 

0.7 

0.5 

B 

10.5 

1.1 

0.7 

0.5 

C 

15 

1.5 

1.0 

0.7 

C 

18 

2.2 

1.0 

0.7 

D 

18 

2.2 

1.2 

1.0 

D 

23 

2.2 

1.2 

1.0 

E 

23 

2.2 

1.2 

1.0 
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The process for establishing the TSE limit is analogous to that used in establishing the relationship 
between the 95% TSE and the CL for other RNP applications. For en route and terminal area 
navigation the containment limit is set to two times the 95% value [3], while for approach and 
landing the relationship is a factor of three [ 1 ]. The difference is the direct relationship between 
normal performance and the boundary for wheel excursions, not the CL. 

2.9.2 Stand Taxilanes 

For the stand taxilanes, all separation distances are slightly reduced from those on taxiways 
because of lower taxi speeds. The margins associated with wing tips are indicated in the right- 
hand column of Table 4. Similarly, the assumed maximum deviations of the main gear are 
reduced [8], and are listed in Table 7. As for taxiways, the 95% performance requirement should 
be established with enough margin to these maximums so that the probability of exceeding the 
values shown in Table 7 is small. Extension of the philosophy with taxiways places the 95% limit 
at one half of the assumed maximums in Table 7, which are also shown in the table. 


Table 7. Stand Taxilane Normal Performance Requirement 


Relationship to Gear Deviation 


Aerodrome 

Code 

Maximum Gear 
Deviation 
(meters) 

95% Performance 
Requirement 
(meters) 

A 

1.5 

0.7 

B 

1.5 

0.7 

C 

2.0 

1.0 

D 

2.5 

1.2 

E 

2.5 

1.2 


2.9.3 Stand 

For the stand, separation distances are reduced even further than those for stand taxilanes. Table 
8 shows the margins [8], an assumed maximum-allowed gear deviation and required 95% 
performance. The maximum gear deviations and 95% performance requirements are maintained 
at the same ratios for each aerodrome code as allowed in the stand taxilane. It should be noted 
that this performance may not be sufficient for parking and docking. The requirements given here 
are related only to safety and are probably insufficient to accurately dock an aircraft at the gate. 
Table 8. Stand Normal Performance Requirement 


Relationship to Wing and Gear ' 

Margins 

Aerodrome 

code 

Wing tip margin 
(meters) 

Maximum gear 
deviation (meters) 

95% performance 
requirement (meters) 

A 

3.0 

1.0 

0.5 

B 

3.0 

1.0 

0.5 

c 

4.5 

1.5 

0.7 

D 

7.5 

2.0 

1.0 

E 

7.5 

2.0 

1.0 
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2.9.4 Position Estimation Error Requirements 


Referring again to Figure 6, the TSE is composed of Path Definition Error (PDE), Path Steering 
Error (PSE) and Position Estimation Error (PEE), represented mathematically as: 

Instantaneous RNP accuracy = TSE = PDE + PSE + PEE ( 1 ) 

PSE is defined as the difference between the defined path and the estimated aircraft position 
PEE is the difference between the actual and estimated positions. PDE is any error in defining the 
desired path (survey and database errors etc ). The combination of PEE and PDE has 
traditionally been referred to as navigation sensor error (NSE). Since they are statistically 
independent, PEE, PSE and PDE are normally Root Sum Squared (RSS’d) together to compute 
TSE. It is also always assumed that the pilot or flight control system is attempting to fly the 
course provided by the guidance system (ILS, MLS, GNSS). However, this assumption is not 
applicable to surface movement. When visibility conditions are such that the pilot is able to track 
the actual centerline by visual reference the track defined by the guidance system may be different 
from the desired track without any effect on overall performance. In fact, in good visibility the 
role of electronic guidance is mainly for enhancing situational awareness. The result is that in 
those cases the PEE, PSE and PDE are not additive as in equation 1. It is only under the lowest 
visibility conditions (Visibility Condition 4) when the pilot is completely reliant on the guidance 
system (as for approach and landing) that the PEE, PSE and PDE would be additive. It is 
proposed that these factors be taken into account when allocating accuracy requirements. 

Based on the background above, the proposed methodology for deriving PEE is as follows: 

1. For Visibility Conditions 1 and 2 (>400 m RVR) the pilot primarily uses visual guidance. The 
electronic guidance is mainly for situational awareness. The accuracy required is only that 
necessary to allow the pilot to determine on which taxiway he is located. The proposed PEE 
is therefore based on the width of the taxiway, which varies according to aerodrome code 
This applies to all taxiways except in the stand areas, since those have no defined width, and 
situational awareness should not be a problem in the stand in good visibility. 

2. For Visibility Condition 3 (75 - 400 m RVR) the pilot still primarily uses visual guidance. The 
electronic guidance could be used for anticipating turns, particularly for implementations with 
a head up display However, the PEE should not be allowed to be too large because the pilot 
may lose confidence in the system. The PSE and PEE are therefore recommended to be equal 
to the specified TSE. This also allows for visual conditions where the pilot may still use the 
electronic guidance, thus ensuring the errors do not exceed the allowed TSE 

3. For Visibility Condition 4 (<75 m RVR) the PSE and PEE are additive and are therefore 
RSS’d to compute TSE. The process used in determining the recommended allocations was 
based on maximizing the PSE allocation The PEE was assigned a value equal to 50 percent 
of the TSE, and the PSE was assigned the remaining portion on an RSS basis. 

Table 9 shows the allocations for rapid exits, normal and apron taxiways for the various airport 
categories by aerodrome code. The PEE values were derived using the methodology described 
above. All values are based on the largest aircraft type for each aerodrome code. For smaller 


13 



aircraft operating on aerodromes designed to accommodate larger aircraft the margins go up 
accordingly, therefore allowing larger TSE, PSE and PEE. For example, a DC-9 is considered a 
code C aircraft and has an outer gear wheel span of 6.0 m. When operating on a code E 
aerodrome the wheel margin becomes 8.5 m instead of the minimum of 4.5. This would allow the 
TSE to be doubled from 2.2 m to 4.4 m Assuming a constant for PSE, the PEE for Visibility 
Condition 4 (Table 9) could increase from 0.8 m to 4.0 m. The conclusion is that for the smaller 
aircraft operating at aerodromes designed to handle the largest aircraft, the increase in safety 
margins will allow significantly larger PEE values. 


Table 9. PEE Allocations For Rapid Exits, Normal, And Apron Taxiways 





Visibility U 

1 — ^ 

Visibility 3 

Visibility 4 

Aerodrome 

Code 

Taxiway 
Width (m) 

TSE 

(95%, m) 

PEE 

(95%, m) 

PSE 

(95%, m) 

PEE 

(95%, m) 

PSE 

(95%, m) 

PEE 

(95%, m) 

A 

7.5 

0.7 

7.5 

0.7 

0.7 

0.6 

0.4 

B 

10.5 

n 

10.5 

1.1 

i.i 

1.0 

0.6 

C 

15 

1.5 

15 

1.5 

1.5 

1.3 

0.8 

C.D 

18 

2.2 

18 

2.2 

2.2 

1.9 

1.1 

D,E 

23 

2.2 

23 

2.2 

2.2 

1.9 

1.1 


Technically, we should also account for an allocation of the PDE. The PDE includes errors in the 
airport survey or navigation database, which have to be accounted for separately from GNSS or 
any guidance sensor. However, assuming these errors are limited to 1 ft (0.3 m) for most cases 
this still leaves almost all of the allocated value to the PEE. For example, for Visibility 4 and 
Codes D and E the PEE is 1 . 1 m. When subtracting out 0.3 m (on an RSS basis) for PDE this 
still leaves 1.06 m for PEE. Based on an assumption that the PDE is limited to 1 ft, all of the 
allocation is made to PEE. Figure 7 summarizes the PEE requirements for Visibility Conditions 3 
and 4. Additional validation is required for the allocation process. 


2.5 


2 

? 

w 1.5 

Hi 

CL 


0.5 

0 


Figure 7. Recommended Lateral and Longitudinal PEE (Visibility Condition 3 and 4) 
2.10 Availability 

Availability is an indication of the ability of the guidance function to provide usable service within 
the specified coverage area Availability is defined as the portion of time the system is to be used 


□ Visibility 3 
B Visibility 4 
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for navigation. During this time reliable navigation information is presented to the crew, 
autopilot, or other system managing the movement of the aircraft. Availability is specified in 
terms of the probability of the guidance function being available at the beginning of the intended 
operation. The availability required for surface movement should not limit the overall operations 
of the aerodrome. As an example, for low visibility operations the guidance function should have 
at least the same availability as the landing system guidance function, otherwise the total operation 
cannot be performed. For providing service in Visibility Conditions 3 and 4, the availability 
requirement should be equal to that of an associated Category III landing system and is 0.999. 

For Visibility Conditions 1 and 2, the availability is equal to that of an associated non-precision 
approach since the pilot can taxi visually, and is 0 95 [5] 

3.0 VALIDATION 

Several methods are being used to validate the proposed RNP. These include use of operational 
data, simulations, field demonstrations, and analysis. 

3.1 Operations 

Several sources of data were used to validate the accuracy allocations. One source was a 
statistical analysis of operational data from London Heathrow Airport consisting of over 77,000 
aircraft taxiing movements on the airport surface [8], Aircraft taxi centerline deviations recorded 
for various aircraft in the U K. study are shown below in Table 10 and correlate well with RNP 
requirements. The majority of the 95% values are within the ± 2.2 m TSE requirement discussed 
in 2.8.1. 


Table 10. Taxi Centerline Tracking Performance, Operationa l Data 


Aircraft 

Straight Sections 

Curved Sections 

Type 

95% (m) 

95% (m) 

A3 10 

±14 

±1.9 

B72S 

±1.4 

±1.9 

B73S 

±16 

±1.8 

B747 

±1.2 

±2.5 

B757 

±14 

±1.8 

BACl-ll 

±1.5 

±1.9 

DC9S 

±1.5 

±2.3 

DC9 

±1.4 

±2.0 

F27 

±1.5 

±1.9 

F28 

±4.6 

±2.0 

S360 

±1.4 

±1.9 

L1011 

±1.1 

±2.3 


Note: Data collected on normal and apron taxiways only. 
Data Source: Heathrow Airport operational data [8] 


3.2 Simulations 

Data from several NASA simulator tests were analyzed, including a Runway Status Light System 
(RSLS) evaluation [16] and a moving map display study [17,18]. For the RSLS evaluation, data 
was collected in the Langley Research Center’s Transport Systems Research Vehicle (TSRV) 
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simulator during the summer of 1994. Twenty-one test subjects piloted a simulated Boeing 737 
aircraft along ten different routes during various visibility conditions at Denver Stapleton Airport. 
This data was not originally collected to measure aircraft deviations from the centerline 
However, since the data collected included aircraft position at discrete intervals, this data could be 
used to evaluate the aircraft’s position throughout the taxiing phase. The data provided a unique 
look at how closely aircraft crews follow the centerline in an actual operating environment with 
their heads up. 


For the moving map display study, NASA’s TSRV simulator was again used to verify the 
performance of electronic maps in the cockpit. Fourteen pilots performed simulated taxiing runs 
along four different routes and two visibility conditions using two different types of map displays - 
a paper map and an electronic map. The deviation of the aircraft center-of-gravity (CG), which is 
located 37 feet behind the aircraft nose, was measured from the taxiway centerline. Centerline 
deviations collected from the RSLS simulation study (Table 1 1) are consistent with the Heathrow 
Airport data (see Table 10). However, the moving map study showed straight section 95% 
centerline deviations significantly greater than the others. The results indicate the limitation in the 
capability to taxi with only the map for guidance. 


Table 11. Summary of Aircraft Taxi Centerline Tracking Performance, Simulation Data 


Aircraft 

Type 

Straight Sections 
95% (m) 

Curved Sections 
95% (m) 

7 — 

Data Source 

B737 

±1.4 

N/A 

1. VFR/day 

B737 

±12 

N/A 

1. VFR/night 

B737 

±1.5 

N/A 

1. RVR 1200’ 

B737 

±1.5 

N/A 

1. RVR 600’ 

B737 

±3.9 

±6.8 

2. VFR 

B737 

±3.7 

±6.2 

2. RVR 150’ 

B737 

±3.9 

±5.2 

2. VFR with map 

B737 

±3.7 

±5.0 

2. RVR 150’ with map 

Note: Data collected on normal and apron taxiways only. 
Data Sources: 

1. RSLS simulator data [16] 

2. Moving map display simulator data [17J8] 


3.3 Field Demonstrations 

Field data was collected during the NASA LVLASO demonstration at Hartsfield Atlanta Airport 
in August 1997. These test were conducted with various configurations of the LVLASO cockpit 
displays, consisting of a Head Up Display (HUD) and moving map. The results (Table 12) are 
consistent with the other operational data, and are also well within the proposed RNP. 
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Table 12. Taxi Centerline Tracking Performance, NASA Demonstration Data 


Aircraft 

95% (m) 

Test Conditions 

B757 

±1.3 

HUD and Moving Map 

B757 

±1.3 

HUD, No Moving Map 

B757 

±1.6 

Moving Map, No HUD 

B757 

±1.6 

No Moving Map, No HUD 


The same field test was used to analyze the performance of local area differential GPS on the 
airport surface. The results indicated horizontal position errors of approximately 1.6 m (95%) 
[32], This meets the position estimation error requirements for visibility 3 for most airports (2.2 
m), and comes close to meeting the proposed requirement for visibility 4(1.1 m). 

3.4 Analysis 

3.4.1 Pilot Failure Risk Analysis 

3.4.1. 1 Introduction 

The purpose of the pilot failure risk analysis is to validate the pilot risk factor component of the 
RNP. This section will detail the analysis of the individual failure modes for several different 
scenarios that may occur on the airport surface. The pilot risk will then be associated with these 
scenarios according to the required response time to avoid an incident. As depicted in Figure 2, 
the total incident risk is comprised of both detected and undetected failures and therefore both 
failure modes must be examined 

3.4.1. 2 Assumptions 

To analyze the pilot failure risk, several assumptions were made including the failure mode 
experienced, the visibility condition, the cockpit display equipment, the number of crew members 
and their respective roles, and the aircraft velocity. Failure modes analyzed include continuity and 
integrity. A warning or signal will be given to the aircraft crew immediately upon a continuity 
failure. An integrity failure will yield no warning, therefore the crew will depend on visual cues to 
recognize that a failure has occurred. Consequently, longer response times can be expected for 
integrity failures Since the crew relies on visual, out-the-window views, visibility will primarily 
drive pilot risk for the integrity failure mode. The three visibility conditions considered are 
described in 2.3. 

As part of the NASA LVLASO (Low Visibility Landing And Surface Operations) program, 
additional cockpit display equipment will be available to assist the crew in low visibility 
conditions. This equipment includes a Head-Up Display (HUD) [20] which will display traffic 
cones outlining runways and taxiways, signs showing the pilot which way to turn, and other data 
pertinent to the operation of the aircraft (speed, heading, altitude, etc.). A Head-Down Display 
(HDD) will be available for either the pilot-in-command or co-pilot’s use. This display will 
contain a map of the airport surface that shows location of own aircraft, other aircraft, airport 
runway/taxiway/gate area locations, and the preferred surface route for the aircraft to follow. 
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The availability of this cockpit display equipment led to assumptions regarding crew numbers and 
roles. For Visibility Condition 1,2, it was assumed that only one pilot would be present in the 
cockpit. Under this visibility condition the pilot should be able to monitor the HDD for situational 
awareness and guide the aircraft using external visual cues. However, under Visibility Conditions 
3 and 4, it was assumed that both a pilot-in-command and a co-pilot would be required. The 
pilot-in-command would be responsible for monitoring the "out-the-window" view with the HUD 
available for additional guidance. The co-pilot would be responsible for monitoring the HDD and 
providing verbal feedback to the pilot-in-command on runway/taxiway location, other aircraft 
locations, and maintaining conformance to the designated route. 

The aircraft velocity when a failure occurs will affect the amount of time the crew has to respond 
to the failure. The greater the aircraft velocity, the longer the braking distance, and consequently, 
the less time available for the crew to. respond. Crew response may also be longer because of an 
increased crew workload when traveling at high speeds on the airport surface (e g., high speed 
exit taxiing). Aircraft speeds assumed for various scenarios are given in Table 1 . Each scenario 
was analyzed for nominal and worst case aircraft velocity, shown in Table 13. Different speeds 
were chosen for the normal/apron taxi phase for the two failure modes, because of the nature of 
each scenario. Lower speeds were used for the continuity failure due to the 90° turn associated 
with this scenario. The scenarios will be discussed in more depth in the following section. 
Furthermore, worst case speeds were analyzed only under dry surface conditions and Visibility 
1,2. It was determined that aircraft would probably not operate at these higher speeds under wet 
airport surface conditions and/or reduced visibility. Conversely, scenarios under Visibility 
Conditions 3 and 4 were analyzed at nominal speeds and wet airport surface conditions. 


Table 13. Aircraft Speeds 



& 

Nominal (kts.) 

Worst Case (kts.) 

High Speed 

30 

50 

Normal/ Apron Speed (Continuity) 

10 

20 

Normal/ Apron Speed (Integrity) 

20 

30 

Stand Taxilane 

5 

10 


3.4.1. 3 Analytical Scenarios 

To analyze the pilot risk factor, several scenarios were created to simulate a possible "real-world" 
situation that may occur while an aircraft is taxiing on the airport surface. These scenarios are 
based on observations made at airports with typical taxiing procedures. The navigation errors 
encountered were chosen to occur at the worst possible time in an attempt to build some 
conservatism into the results. Scenarios were created for both continuity and integrity failure 
modes. Furthermore, each failure mode was analyzed at three different phases of taxiing: high 
speed, normal, and stand taxilane. 

3.4. 1.3.1 Continuity Failure Scenarios 

The continuity failure scenario is based on an aircraft making a turn from the runway to the 
taxiway. At the midpoint of the turn the navigation system fails and the crew is given a warning. 
The crew is instructed to bring the aircraft to an immediate stop. At the point of failure it is 
assumed the aircraft continues in a straight line as the crew responds to the failure and begins 
braking This straight line assumption minimizes the distance between the failure location and the 
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nearest possible object as defined by the ICAO Aerodrome Design Manual for Code E aircraft 
[8], By minimizing this distance, the most critical scenario is chosen. A depiction of this scenario 
is shown in Figure 8 for normal taxi and in Figure 9 for high speed taxi. 



Figure 8. Continuity Failure During Normal Taxi 

Note - Stand Taxilane scenario is similar, but distance from Centerline to Object is 42.5 m. 



Figure 9. Continuity Failure During High Speed Taxi 


3.4. 1.3.2 Integrity Failure Scenarios 

The integrity failure scenario is based on an aircraft taxiing along a straight section of runway 
when it encounters a 20 meter waypoint error in the navigation route. Since this error is 
undetected by the system, no warning or alert is provided to the crew. With no warning or alert, 
the crew must recognize that a failure has occurred and begin immediate braking of the aircraft to 
avoid running off the pavement. A 20 meter waypoint error was chosen to represent the largest 
error that may be possible without becoming obvious to the crew taxiing along a typical 46 meter 
wide runway. Waypoint errors of this size on a taxiway would presumably be more readily 
detectable to the crew due to the much smaller width of the taxi way (23 meters). A more 
reasonable waypoint error for the taxiways would be 10 meters and result in twice the distance 
before the aircraft left the pavement. Therefore, the runway was analyzed, because it presented a 
more demanding scenario with shorter distances to incident than taxiing along a taxiway. For the 
normal taxi phase, the distance chosen (300 m) for the error to occur is based on the average 
segment length of an aircraft’s taxi route at Atlanta Hartsfield airport and Denver Stapleton 
airport. For the high speed taxi phase, the distance (344 m) is based on the spacing between high 
speed exits at Atlanta Hartsfield airport. Figures 10 and 1 1 below illustrate scenarios for normal 
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and high speed taxi phases respectively. In both scenarios, the airplane was assumed to be off the 
pavement when the aircraft nose was 15 meters from the runway centerline. 



Figure 10. Integrity Failure During Normal Taxi 



Figure 11. Integrity Failure During High Speed Taxi 


The stand taxilane scenario is similar to the integrity failure during normal taxi phase (Figure 10) 
except the waypoint error is only 10 meters due to the tighter spacing within the gate area. The 
distance the aircraft is from the erroneous waypoint was set at 52 meters to represent typical gate 
spacing at Atlanta Hartsfield airport. Table 14 summarizes the Distance to Incident (d;) for each 
of the scenarios described above. 


Table 14. Distance to Incident 


Taxi Phase 

Distance to Incident (m) 

Failure Mode 

Continuity 

Integrity 

High Speed 

286 

258 

Normal/ Apron 

72 

225 

Stand Taxilane 

66 

52 


3.4.1. 4 Response Times 

3.4. 1.4.1 Aircraft Crew Response Times 

The average aircraft crew response times to the various modes of failure were determined by 
researching existing relevant human factors studies. Appendix C summarizes the studies used. 
Under a continuity failure, the crew is reacting to either a visual or audio warning from within the 
cockpit and relatively short response times can be expected. For integrity failures, the crew is 


20 




reacting to a visual reference that is either an “out-the-window” view or the view obtained from 
the cockpit mounted HDD. Because the crew is relying predominately on the “out-the-window” 
view, longer response times can be expected with decreasing visibility. Figure 12 summarizes the 
crew response times assumed for this study. 



Continuity, Integrity, Integrity, Integrity, 

All Vis. Vis. 1,2 Vis. 3 Vis. 4 

Failure Mode, Visibility Condition 


Figure 12. Aircraft Crew Mean Response Times 

The times shown above represent the time required by the crew to initiate aircraft braking. Under 
all failure modes, the crew’s response is to begin an immediate, hard/panic stop of the aircraft 
Further validation of these response times should be performed through aircraft simulator testing 
using these emergency conditions. Appendix D describes the method used to correlate pilot 
response times with the risk of a pilot failing to respond in time to a failure (pilot risk). It was 
assumed that pilot response time could be modeled with a normal probability distribution. A 
value of one second was chosen for a for continuity failures in all visibilities. This value is 
consistent with pilot reaction times to TCAS resolution advisories [21]. For integrity failures, it 
was assumed that visibility will affect reaction times. For degraded visibilities (Visibility 
Conditions 3 and 4), standard deviation was set equal to the mean response time (Figure 12). 
These values are consistent with studies conducted for pilot reaction times to more complex 
situations than an auditory alarm [22, 26], 

3.4. 1.4.2 Aircraft Response Times 

The response time of the aircraft is that time required to bring the aircraft to a complete stop once 
the crew initiates braking. Maximum deceleration rates for the Boeing 747-400 were obtained 
from Boeing and used to calculate the braking distance. A firm, comfortable rate of 6 fl/sec 2 ( 2g) 
was analyzed, as well as a hard, panic stop of 12 ft/sec 2 (4g). Because of the shorter stopping 
distances, the 4g hard, panic stop was chosen for this analysis. The 747 was chosen to establish a 
worst case scenario. Most other aircraft will have shorter braking distances. Aircraft braking was 
analyzed under wet and dry airport surface conditions. Under wet runway conditions, aircraft 
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stopping distances become longer because of the decreased coefficient of friction of the airport 
surface. Consequently, after a failure occurs under wet conditions, more time will be needed to 
brake the aircraft and less time will be available for the crew to respond. As stated under the 
assumptions in 3.4. 1.2, wet conditions were assumed under Visibility Conditions 3 and 4 and only 
at nominal speeds. 

Once braking distances were obtained, the maximum amount of time the crew had to respond to 
the failure was determined. This is simply the aircraft braking distance subtracted from the 
distance to the incident (di) divided by the aircraft velocity when the failure occurred. Subtracted 
out of this total was an additional .75 seconds that is required on the 747-400 to engage the brake 
pistons once braking action is applied. Refer to Appendix D for a detailed discussion of the 
mathematics 

3.4. 1.4.3 Response Time Summary 

The assumptions made in this analysis and the corresponding results are contained in Table 14 
Based on runway conditions, aircraft braking distance, maximum time for crew to respond, and 
the extra time for the crew to respond were calculated. This calculated "extra time" to respond 
represents the excess time the crew has to respond to the failure, which in turn determines the 
pilot failure risk. 

3.4.1. 5 Pilot Failure Risk 

Several factors must be taken into account when calculating pilot failure risk. The total pilot 
failure risk consists of essentially four components: the relative exposure for the failure condition, 
the reaction time distribution, the aircraft speed distribution, and the airport surface condition. 
These four factors are illustrated Figure 13. 



Figure 13. Pilot Risk Tree 

The relative amount of exposure time the aircraft spends in a turn could be used to more 
accurately determine the probability of the failure occurring in the turn. To go one step further. 
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the amount of exposure time the aircraft spends at the turn’s apex (where continuity failure was 
assumed in this analysis) could be added into the total pilot risk calculation. This study did not 
factor in this probability, because of the lack of any substantial data collected to quantify this 
variable. 

Reaction time distribution was the primary factor analyzed in this study to determine pilot failure 
risk. Based on the previously discussed scenarios and corresponding assumptions, the crew’s 
excess time to respond to the failure was calculated. Once excess time was determined for each 
scenario, the probability of the crew response time exceeding this time could be modeled with a 
normal probability distribution. Appendix D contains a detailed discussion of this analysis. 

The probability of the aircraft being at the worst case speed when the failure occurs can also be 
used to refine the calculations. In this analysis, this probability was factored into the calculation 
of the pilot failure risk for the continuity failure scenarios where the aircraft is in the stand taxilane 
and normal/apron phase of taxiing. It was assumed that aircraft speeds on the airport surface 
could be approximated by a normal probability distribution and the worst case speed represents 
two standard deviations of this distribution (2a). This 2a value equates to the aircraft traveling at 
worst case speeds or greater 5% of the time. Finally, the probability that worse case surface 
conditions will exist were indirectly taken into account in this study. As stated in the assumptions 
in 3.4. 1.2, aircraft will probably operate under wet airport surface conditions under Visibilities 3 
and 4, but only at nominal speeds. At Visibility Conditions 1,2, operations were assumed to take 
place on a dry surface, but at worst case speeds. Ice and snow covered surface conditions were 
not evaluated in this analysis. 

Based on our analysis of the previously mentioned scenarios, the proposed pilot failure risks were 
conservative in their estimates for all but three scenarios. It was determined for these scenarios 
that the proposed pilot risks were too low and should be increased. These three scenarios are: 

1. Visibility Condition 1,2, normal/apron taxi phase, continuity failure mode, 

2. Visibility Condition 1,2, high speed taxi phase, integrity failure mode, 

3 Visibility Condition 3, high speed taxi phase, integrity failure mode. 

Of these three only the first two changed the previously proposed requirement. These changes 
resulted in a modification to the continuity and integrity specified risk for visibility condition 1,2. 
The allocated risk for continuity, Visibility Condition 1,2 decreased from 6.0 x 1 O' 3 to 3.0 x 10' 3 . 
The allocated risk for integrity, Visibility Condition 1,2 decreased from 3.0 x 10‘ 3 to 2.0 x 10" 4 , 
roughly an order of magnitude. The validated pilot risk allocations and the validation analysis 
results for each scenario are presented in Table 15. The pilot risk allocations are also listed in 
Table 2 and graphed in Figure 3. 

3.4.2 Functional Hazard Assessment 

The failure mode analysis demonstrated close correlation with the aircraft system design standards 
contained in Federal Aviation Regulation (FAR) 25-1309, FAA Advisory Circular 25.1309-1A 
[24] and Joint Aviation Requirement (JAR) 25 [25] These standards relate the consequences and 
severity of effects of system failures and required probabilities. Table 16 shows these 
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relationships and Table 17 shows how these compare to the most stringent surface movement risk 
requirements. Most cases fall within the minor category which requires a failure rate between 10' 3 
and 10' per hour. The only exception is Visibility Condition 4 integrity which is classified as 
Major, with a failure rate between 10‘ 5 and 10" 7 Overall, the failure condition effects associated 
with the surface movement failure modes are consistent with the categories defined by the FAR 
and JAR requirements. It should be noted that this comparison can only validate that failure 
probabilities are within the right failure classification range, or roughly two orders of magnitude. 

3.4.3 Further Validation 

Due to limited data available to date, it is recommended that additional data be collected to 
further substantiate the proposed RNP requirements presented herein. Additional simulator 
testing should be conducted to verify the pilot reaction times to the various failures assumed in the 
pilot failure risk analysis. Further verification of the achieved accuracy performance should be 
conducted with additional simulator and field testing. These tests should be performed under the 
visibility conditions specified in this report in an attempt to recreate the scenarios analyzed. 
Naturally, varying visibilities will be easier to control under simulator conditions, but night 
conditions could be used during the field testing. 
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Table 15. Scenario Assumptions and Results 
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. For all Visibilities 1,2 assumed pilot only crew member. 
». For all Visibilities 3 and 4 assumed two crew members. 




Table 16. Relationship Between Probability and Severity of Effects 
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Table 17 . Comparison of the Analyzed Risk with the FAR/JAR Required Risk 
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4.0 CONCLUSIONS AND RECOMMENDATIONS 

Use ofRNP for all phases of flight is accepted by the aviation community, in the U S. and 
internationally . The approach and landing RNP has pioneered the process and analytical 
techniques used to define aviation standards and requirements for accuracy, continuity, integrity, 
and availability. Application of the RNP described in this report to the runway surface has used 
the same process, but for a two-dimensional surface with unique navigation requirements. For the 
surface RNP, work to date has focused on the analytical aspects of the process, the classification 
of operations, the allocation of risks to each operational phase, and the calculation of containment 
limits, integrity and continuity requirements. Operational and simulator data have been used to 
validate the analyses; however, validation in some areas is limited, and further simulation and field 
trials are required. The process and data used to develop the surface RNP have been coordinated 
with aviation standards organizations including ICAO All Weather Operations Panel and RTC A. 
RTCA is in the process of developing requirements for airport surface navigation and 
surveillance. The RNP requirements presented in this paper can be a primary input to the 
navigation requirements. The following summarize the key RNP requirements. 

• Target Level of Safety - l.Ox 10' 8 fatal taxi accidents per operation. 

• Integrity and Continuity Risk (per hour): 



Visibility Condii 

lion | 

1,2 
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heh 


WBgfBSi 



| Continuity 

EHEIi 




• Containment Limits (aerodrome codes D and E) - 15 m for taxiways, 10 m for stand 
taxilanes, 7.5 m for stand areas. 

• Normal Performance Requirements (aerodrome codes D and E) - 2.2 m for taxiways, 

1 .2 m for stand taxilanes, 1 .0 m for stand areas. 

ICAO, FAA and RTCA are all currently developing requirements for local area differential GNSS 
to support Category I, II, and III approach and landing. It is intended that local area navigation 
systems be capable of supporting surface operations. The requirements described in this report 
should be considered in the development of local area differential GNSS standards to be sure that 
these systems will adequately support surface operations. It is recommended that further 
simulator studies and field studies be conducted to validate the proposed RNP. Specifically, 
simulator studies are recommended to characterize crew reaction to failures, while simulator and 
field tests are recommended to validate achieved accuracy performance. This should also include 
an evaluation of the magnitude of acceptable Position Estimation Errors for moving map and 
HUD applications under various visibility conditions. 
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ACRONYMS 


A-SMGCS - Advanced Surface Movement Guidance and Control Systems 

ATEDS - Airport Surface Target Identification System 

AWOP - All Weather Operations Panel 

CG - Center-of-Gravity 

CL - Containment Limit 

DGPS - Differential Global Positioning System 

FAR - Federal Aviation Regulation 

GNSS - Global Navigation Satellite Systems 

GPS - Global Positioning System 

HDD - Head-Down Display 

HUD - Head-Up Display 

ICAO - International Civil Aviation Organization 

ELS - Instrument Landing System 

JAR - Joint Aviation Requirement 

LVLASO - Low Visibility Landing And Surface Operations 

MASPS - Minimum Aviation Systems Performance Standard 

MLS - Microwave Landing System 

NTSB - National Transportation Safety Board 

PDE - Path Definition Error 

PEE - Position Estimation Error 

PSE - Path Steering Error 

RNP - Required Navigation Performance 

RSLS - Runway Status Light System 

RSS - Root Sum Square 

RVR - Runway Visual Range 

SSR - Secondary Surveillance Radar 

TCAS - Traffic Alert and Collision Avoidance System 

TLS - Target Level of Safety 

TSE - Total System Error 

TSRV - Transport Systems Research Vehicle 
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APPENDIX A 
TAXI SPEED ANALYSIS 



A1 DEFINITION OF SURFACE MOVEMENT RNP TAXI SPEEDS 

A1.1 Atlanta Hartsfield Data 

Taxi data from Atlanta was gathered using the experimental Airport Surface Target Identification 
System (ATIDS). ATIDS is a multilateration system that receives Secondary Surveillance Radar 
(SSR) transmissions and triangulates, or multilaterates, from several receiver locations to 
determine the location of an SSR transponder. It is designed to work with aircraft equipped with 
Mode A/C and S transponders. All of the data used in the analysis presented here are from Mode 
S equipped aircraft. 

The data available from Atlanta is used here primarily to evaluate velocities on high speed 
taxiways. The average velocity of the plane in that region, as well as its maximum and minimum 
velocities, were evaluated. For the high speed exits, as at Atlanta (Figure Al), the maximum 
velocity normally corresponds to the speed at which the plane exits the runway, and the minimum 
velocity usually corresponds to termination of the high speed exit phase. Examination of the data 
reveals that some aircraft will slow down and then accelerate to a faster speed, therefore it cannot 
be assumed that all aircraft constantly decelerate. 

For Atlanta Airport, the maximum, minimum and average velocities were calculated for each 
aircraft exiting at one of the high speed exits, exit B1 1 (Figure A2). Tables Al and A2 summarize 
the calculations and are grouped according to aircraft type. Since the B 1 1 exit was used most 
often, estimates there are more statistically significant than for the B7 exit. For the B1 1 exit, the 
maximum velocity for any aircraft was 60 knots, with only three having maximums greater than 
50 knots. The minimum velocity was 13.2 knots and the overall average velocity was 31.7 knots. 
For the B2 exit, the maximum velocity was 48. 1 knots, the minimum velocity was 15 .1 knots, and 
the average velocity was 29.4 knots. Figures A3 and A4 illustrate typical velocities measured for 
aircraft using both the normal and high speed runway exits and subsequent taxi to the apron areas. 
There is not sufficient data available for a statistical analysis of taxi speeds on normal taxiways. 

The main reason is due to current procedures, where transponders are switched off immediately 
after landing and prior to arrivals in the gate area. 

A1.2 London Heathrow Data 

The second set of data came from London Heathrow Airport [6], Figures A5 and A6 summarize 
results as bar charts. For the outer curve the average velocity was 16.4 knots and the 95% values 
are all less than 24 knots The maximum velocity for any aircraft was 33 knots, with all others 
being less than 30 knots. However, this data was collected on a more shallow curve 
(approximately 60°) than the taxiway turn for which the taxi speed range was established in Table 
1 (90°), so a direct comparison cannot be made. For the straight section, the average velocity 
was 16.9 knots and the 95% values are all less than 27 knots. The maximum velocity for any 
aircraft was 49 knots, with the maximum for most being slightly over 30 knots. 

A1.3 Conclusion 

Based on this analysis, the range of taxi speeds for the various phases are as shown in Table 1 of 
the report. 
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Figure Al. Atlanta Hartsfield Airport Layout (North End) 



Figure A2. Atlanta Runway 8L High Speed Exits - Regions Defined for Velocity 

Evaluation 
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Table Al. Atlanta High Speed Exit Bll Velocity Data 



Table A2. Atlanta High Speed Exit B2 Velocity Data 
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Atlanta, B-737, October 19, 1995 











Atlanta, B-737, October 19, 1995 
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Figure A4. Typical Taxi Velocities (high speed runway exit) 
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Figure A5. Heathrow 
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Figure A6. Heathrow Measured Taxi Speed - Curved Section 




APPENDIX B 

EXPOSURE TIME ANALYSIS 



B1 DEFINITION OF SURFACE MOVEMENT RNP EXPOSURE TIMES 

For each phase of aircraft surface movement (high speed taxi, normal taxi, apron) a risk of failure 
associated with each RNP function (integrity and continuity) is calculated given various visibility 
conditions. A risk rate (risk/time) can be determined by estimating the exposure time for each 
phase of surface movement. 

B1.1 Normal Taxi and Apron Exposure Time Calculation 

This section estimates exposure times during the three phases of taxiing at various international 
U S. airports. To calculate exposure times for normal taxi and apron maneuvers, taxi phase 
velocities were assumed to be 20 knots and 5 knots for normal taxi and apron, respectively. Three 
cases were examined, worst case, and two average taxiing run cases. Taxiing distances were 
measured from airport schematics with proper scaling. The worst case scenarios were assumed to 
have the longest normal taxi and (possibly) apron distances. The nominal cases were assumed to 
have average distances from two major runways to a centrally located terminal. Results are 
shown in Table Bl, and the taxiing routes for each airport are shown in Figures B1 through B9. 

B1.2 High Speed Taxi Exposure Time Calculation 

Taxi data from Atlanta was gathered using the experimental ATIDS. Data on aircraft landing on 
runway 8L at Atlanta Airport and exiting onto high speed taxiway Bl 1 were analyzed. Landing 
and taxiing data were segregated to include only high speed taxi data. The segregation followed 
two criteria. First, the data used must have fallen within specific boundaries imposed on the 
taxiway. Second, once the aircraft entered this boundary, the first data point where velocity 
reduced below the assumed high speed taxi maximum (60 kts) became the first segregation point. 
Searching the data from the exit termination backwards, the first data point that was larger than 
the high speed taxi minimum was declared the second segregation point. All data between these 
two points were used for exposure time calculation (even though some data were outside the 
velocity bounds). In addition, boundary dimensions were chosen to include data that might be 
slightly outside the high speed taxi exit but still be within the velocity bounds (30 knots < V < 60 
knots). 

High speed taxi velocities were calculated using three different methods (see Figure BIO). The 
first (I) involved numerically integrating the curve-fitted line length over velocity functions from 
data gathered at Atlanta Airport. The average exposure time was found by taking the mean of all 
individual exposure times calculated. The second method (II) again used fitted functions of the 
position and velocity Mean values of second-degree interpolation coefficients were used for an 
average line-length over velocity integration yielding an average exposure time. The final method 
(III) used the mean log time of all runs from the Atlanta data as the average exposure time. 

Figure Bl 1 shows a histogram of the number of aircraft within time ranges of 10-20 seconds, 20- 
30 seconds and greater than 30 seconds, and Table B2 lists the average exposure times calculated 
by the three methods. 
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B1.3 Conclusions 

The results of the study indicate that for high speed taxi, the maximum exposure time (worst case 
scenario) is around 20 seconds. It is reasonable to assume that this does not vary significantly for 
different runways. Therefore, it is recommended that the exposure time be specified at 30 
seconds, placing an upper bound on the value. For normal taxi, the maximums were found to be 
approximately 6 minutes, with the average taxi routes being approximately 3 minutes. The 
majority of scenarios will be significantly less than 6 minutes, but is difficult to quantify due to the 
large variation in taxi routes possible. The recommendation is to define the exposure time to be 6 
minutes, on the assumption that this value encompasses 95% of all cases. For the apron phase, 
the maximums were found to be approximately 3 minutes, with the average at 2.5 minutes. Using 
reasoning as stated for normal taxi, it is recommended that the exposure time be defined at 3 
minutes. 
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Facility 

Taxi Phase 


IEE§S3 

wmm 

Distance (ft) 


HR3H 

ATL 

Normal (20 kts) 

5.4 

10943 

2.66 

5377 





4.29 

2170 

2.79 

1415 

2.79 

1415 









BOS 

Normal (20 kts) 

6.4 

12900 

1.5 

3000 

2.1 

4200 


Apron (5 kts) 

0.9 

460 

1.6 

796 

2.4 

1200 









DEN 


9.4 

19000 

6.3 

1300 

5.8 

11700 


Apron (5 kts) 

1.1 

559 

1.5 

745 

1.5 

745 “1 









DFW 

Normal (20 kts) 

3.8 

7700 

1.7 

3400 

2.6 

5400 



4.2 

2100 

1.7 

860 

1.7 

860 









IAD 

Normal (20 kts) 

6.5 

13100 

5.3 


3.0 

6000 


IKJEJSSKESM 

8.3 


4.9 

2500 

4.5 

2300 









JFK 

Normal (20 kts) 

8.1 

16500 

3.4 

6800 

1.0 

2000 



3.7 

1900 

4.9 

2500 

1.9 

980 









LAX 

Normal (20 kts) 

5.0 

10100 

2.2 

4500 

3.0 

6200 



1.6 

800 

2.1 

1000 

1.9 

960 

— 

■Mil 








EBsmassm 

6.9 

1400 

2.9 

5800 

2.8 

5700 


Apron (5 kts) 

2.3 

1100 

2.0 

1000 

2.0 

1000 









SEA 

Normal (20 kts) 

3.8 

7700 

2.6 

5200 

0.3 

600 



3.2 

1600 

1.0 

480 

3.9 

2000 


Averages 

Normal (20 kts) 

6.1 

11038.1 

1 Nominal 1&2 

2.9 

5165.0 


Apron (5 kts) 

3.3 

1654.3 


2.5 

1245.0 


Table Bl. Taxi Phase Exposure Time and Route Distances for Various U.S. Airports 


Method 

Exposure Time 
(sec) 

I 

20.7 

ii 

13.0 

hi 

14.0 


Table B2. High-Speed Taxi Exposure Times 
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5,000 ft. 35L 

Figure B3. Schematic of Denver International Airport (DEN) Showing Worst Case and 

Nominal Taxi Routes 
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Figure B4. Schematic of Dallas-Fort Worth International Airport (DFW) Showing Worst 

Case and Nominal Taxi Routes 












1,000 ft 

5,000 ft 

Figure B5. Schematic of Dulles International Airport (IAD) Showing Worst Case 

and Nominal Taxi Routes 
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Figure B7. Schematic of Los Angeles International Airport (LAX) Showing Worst Case 

and Nominal Taxi Routes 


Worst Case 



1,000 ft 

5,000 ft. 


Figure B8. Schematic of Chicago O’Hare International Airport (ORD) Showing Worst 

Case and Nominal Taxi Routes 
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Figure B9. Schematic of Seattle-Tacoma International Airport (SEA) Showing Worst Case 

and Nominal Taxi Routes 
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Figure BIO. Average Exposure Time Equations 
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Figure BU. Measured High Speed Exposure Times (ATL) 
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APPENDIX C 

SUMMARY OF REACTION TIME STUDIES 



Pilot Reaction Times Studies Summa 
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lote - See main report for references. 






APPENDIX D 

CALCULATION OF PILOT FAILURE RISK 



To validate the pilot failure risk, the probability that an aircraft crew would exceed an allotted 
time to respond to an integrity or continuity failure was investigated. The following variables and 
equations were used to solve for this probability. 

Variables defined: 

houi time elapsed from when the failure occurs to when the aircraft leaves the pavement 

or impacts an object 

tota l distance from where the failure occurs to an object or the runway edge 
(Section 3.4. 1.3) 

trespond ~ trecognize + treact where trecogn^,; is the time it takes for the pilot to identify a failure 

and treact is the time required for the pilot to physically react to the failure. Pilot 
reaction time (treact) is a measure of the pilots muscular reaction time and was 
assumed to be 0.5 seconds for each case. This is consistent with human response 
studies conducted with aircraft midair collision avoidance and automobile collision 
avoidance reaction times [28, 29], Time to recognize (trecogmzc) will vary with 
visibility and speed (workload). Table D1 lists the assumed values for trespond for 
the various scenarios and visibility levels. 

t brake time elapsed from initiation of braking until the aircraft comes to a stop 

dbrake total distance traveled from initiation of braking until the aircraft comes to a stop 

textra the amount of safety margin the pilot has before the aircraft leaves the pavement or 

impacts an object if the pilot were to respond in the assumed amount of time in 
table D 1 

tRMax maximum time for the crew to respond (trespond + U,) 

a deceleration rate of aircraft (-12 ft/sec 2 ) 


Taxi Phase 

Average Crew Response Times (sec*) 1 

Continuity 

Integrity 

All Visibilities 

■mm 

Vis 3 

Vis 4 


3 


4 

5 

Normal 

2 

2 

3 

4 

Stand 

1 

2 

2 

3 


Table Dl. Average Crew Response Times (trespond) 
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Figure Dl. Relationship Between Variables 

The maximum hard, panic stopping deceleration rate of -12 ft/sec 2 for the Boeing 747-400 was 
used. The time to stop the aircraft (tbrake) can then be solved with the following equations: 

VfiMl = Vinitial + a*tbrake = 0 (D-l ) 

solving for W e : 


t 


brake 



(D-2) 


Braking distance can now be solved for: 

dbrake = (Visual* We + '/ 2 *a* WeVpfactor ( D ' 3 ) 

where the Wtor is the ratio of friction coefficients of dry pavement to wet (if applicable) 

Now, the maximum time the crew has to respond, tRMax (W* + trespond), can be solved for: 

tRMax= d - -- ^ -0.75 (D-4) 

initial 


where 0.75 is the time for the brake piston stacks to engage. 

Next, the following relationship can be written between the various times: 

ttotal — trespond tbrake t extra 
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tioul tbrake tRMax 


(D-6) 


substituting t to ui (equation D-6) into equation D-5 and solving for t extra yields: 


textra tRMax ~ t respond 


(D-7) 


Now the relationship between Wa and pilot risk is established. The probability of the pilot 
exceeding textra was solved for by assuming pilot response times may be modeled with a normal 
probability distribution. The probability that textra will be exceeded is equal to the area under the 
normal probability curve from textra to oo (Figure D2). 



Figure D2. Probability of Exceeding text™ 
The normal probability function [30] is given by: 

1 '{{x-mVcj] 


fix) 


V2 


KG 


(D-8) 


where a is the standard deviation and p is the mean of the distribution. 


The area under the curve can be solved for by integrating f(x) from textra to oo. More simply, this 
same area can be solved for by integrating f(x) from p to text* and subtracting from the total area 
under the curve. The total area under half of a normal distribution is equal to Vi In equation 
form, the probability is given by: 


1 p 

P( textra, M-, Cj) = “ ~ I 

v J L 


1 f Ultra 1 

2 f flira 


-[(Ux/ra-p)/ay 


(D-9) 


The integral is not explicitly solvable, but can be approximated to a high degree of accuracy with 
numerical methods. In this case, the Romberg numerical integration technique [3 1] was used. 

The input values for ct and p were selected as follows. In all cases the probability curves are 
centered at t = 0, therefore the mean value, p, is always equal to zero. This is because the 
probability being investigated is the probability of a pilot exceeding the average response time 
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(trcpond. Table Dl) plus the extra time (W.) to respond to a failure. Because the average response 
time is already subtracted from the total time to solve for W, (equation D-7), the probability of 
interest is the probability from t extra to x with p equal to zero. The explanation for the selection of 
the standard deviation, a, can be found in Section 3.4. 1.4. 


D-5 



